Portmaster DNS Server - need help!!

[FrostBlade5]

I decided to make use of portmaster, a program to control ALL inbound and outbound network traffic on my device, it's as good for privacy as protonvpn.
The thing is, portmaster allows to choose between four dns providers, but i am also able to enter a custom dns server. Sadly i can't figure out how to use the default dns server from my isp which is what proton recommended me many times in order to prevent dns leaks and letting protonvpn overwrite the default dns server, it appears now protonvpns dns server is overwritten by portmaster.
In short: I want to use portmaster but let protonvpn overwrite portmasters dns server, how can i do that? How can i configure either program to have higher priority than the other?

[davegson]

you can configure your preferred DNS server with this guide:
https://docs.safing.io/portmaster/guides/dns-configuration

a bit technical, but the main components you need is the ip of Proton's DNS over TLS server (ask them if it's not easily publicly findable - did a quick search and did not find it) as well as their verification URL.

you can trial and error the blockedif parameter, just try the 3 different options until it works

[arch-user-france1]

You cannot make a VPN overwrite your DNS settings.
You also probably don't understand what a DNS leak is, read this: https://en.wikipedia.org/wiki/DNS_leak

[arch-user-france1]

can't figure out how to use the default dns server from my isp which is what proton recommended me many times
You should not do that.

A short description of what a DNS leak is:

Every domain dame belongs to an IP. Before the browser will connect to a website it "asks" the system to resolve the domain name (or does it itself).
Now it might be that your DNS request doesn't go through the VPN, meaning the system/browser will resolve the domain name using your providers DNS. The provider then knows by simply looking at the domain names your system/browser sends to the DNS what websites you visit.

Using Portmaster everything should be fine. You SHOULD NOT use your providers DNS if you want to be safe.
Note that VPNs don't provide any privacy anyway. Proton probably sells your data or sends it to the government. Don't trust any VPN - even Tor is questionable in privacy since the gonverment kinda overtook it.

[FrostBlade5]

you can configure your preferred DNS server with this guide: https://docs.safing.io/portmaster/guides/dns-configuration

a bit technical, but the main components you need is the ip of Proton's DNS over TLS server (ask them if it's not easily publicly findable - did a quick search and did not find it) as well as their verification URL.

you can trial and error the blockedif parameter, just try the 3 different options until it works

The problem is protonvpn has over 125 different free vpn servers and each of them uses their own dns server.
There is no official protonvpn dns server, there are many.
I need to find out how to overwrite portmasters dns server with protonvpn completly.

For example... in my windows network adapter setting i use cloudflare 1.1.1.1 but in portmaster i use quad9 9.9.9.9
As a result 9.9.9.9 will be the dns server meaning it overwrites the windows networkadapter, now how can i do the same with protonvpn over portmaster? Again entering a single dns server is not possible as there is none, but many.

[FrostBlade5]

You cannot make a VPN overwrite your DNS settings. You also probably don't understand what a DNS leak is, read this: https://en.wikipedia.org/wiki/DNS_leak

can't figure out how to use the default dns server from my isp which is what proton recommended me many times You should not do that.

A short description of what a DNS leak is:

Every domain dame belongs to an IP. Before the browser will connect to a website it "asks" the system to resolve the domain name (or does it itself). Now it might be that your DNS request doesn't go through the VPN, meaning the system/browser will resolve the domain name using your providers DNS. The provider then knows by simply looking at the domain names your system/browser sends to the DNS what websites you visit.

Using Portmaster everything should be fine. You SHOULD NOT use your providers DNS if you want to be safe. Note that VPNs don't provide any privacy anyway. Proton probably sells your data or sends it to the government. Don't trust any VPN - even Tor is questionable in privacy since the gonverment kinda overtook it.

I think you missunderstand.
Protonvpn says to use the default dns server (ISP) in windows network adapter settings so that protonvpn can then "overwrite" the ISP with their OWN dns server. And this does work as i did various dns tests showing that some company from the netherlands was my ISP which it actually is not.
However when i enter a custom dns server like cloudflare or quad9 into windows network adapter settings this results in dns leaks and as protonvpn said they are unable to guarante privacy which such a setup.

I only use my ISPs dns server because protonvpn needs that to guarante privacy, a custom dns server would overwrite protonvpns dns server.

[arch-user-france1]

Using Cloudflare DNS over HTTPS/TLS you should be fine (if you trust cloudflare).

If protonvpn overwrites the DNS then you should use their DNS. Do you know it?

[FrostBlade5]

Using Cloudflare DNS over HTTPS/TLS you should be fine (if you trust cloudflare).

If protonvpn overwrites the DNS then you should use their DNS. Do you know it?

I don't trust cloudflare, then id rather pick quad9.
Looks like you didn't even read my last reply. Protonvpn doesn't have a DNS Server, they have multiple and deepening on which of their vpn servers you connect to you will get that specific dns server, since you are always randomly connected to one of the free servers you will always have a different dns server. . . .

[arch-user-france1]

That's something completely different. You cannot turn that off unless portmaster has an option to only use the system resolver which would be ProtonVPN in that case - you may contact the developer or Portmaster for that question.

Or you could check which resolver is used (either the one from portmaster or the one from protonvpn). I don't know how that can be done in Windows, in Linux you can see it by using the dig command.

[davegson]

Hey there, I have not read everything in detail but I think this is valuable to just drop in here. It's a conversation about why you cannot disable Secure DNS easily - basically it would remove the ability to block a lot of the nasty trackers based on the filter lists.

Starting at:
#677 (comment)

Sorry you are not getting the support you deserve, but we have limited resources and investing time to help configure specific setups is currently not part of our capacity.

The best thing I can offer is to either go for Quad9, which we feel is a great provider in terms of privacy or to find out the DNS server IP of ProtonVPN, if they support DNS over TLS. If ProtonVPN only supports plain DNS then that would be just odd - since your ISP could still track your DNS requests...

[arch-user-france1]

I decided to make use of portmaster, a program to control ALL inbound and outbound network traffic on my device, it's as good for privacy as protonvpn. The thing is, portmaster allows to choose between four dns providers, but i am also able to enter a custom dns server. Sadly i can't figure out how to use the default dns server from my isp which is what proton recommended me many times in order to prevent dns leaks and letting protonvpn overwrite the default dns server, it appears now protonvpns dns server is overwritten by portmaster. In short: I want to use portmaster but let protonvpn overwrite portmasters dns server, how can i do that? How can i configure either program to have higher priority than the other?

Just so you know: You could use the SPN instead of ProtonVPN, but of course, it's always a thing of trust.

Maybe you don't trust Portmaster but you trust Proton or Proton is cheaper.

[FrostBlade5]

Well, the SPN is payed as far as i can tell and i am broke.

[arch-user-france1]

Well, the SPN is payed as far as i can tell and i am broke.

ProtonVPN is just as expensive as the SPN. Both cost 9 "money", Euros and Dollars

[FrostBlade5]

Well, the SPN is payed as far as i can tell and i am broke.

ProtonVPN is just as expensive as the SPN. Both cost 9 "money", Euros and Dollars

protonvpn is free.

[arch-user-france1]

Yeah I've read that after I posted but I am sure that ProtonVPN = 0 privacy anyway. I wouldn't trust it. Especially free VPNs are the worst...

You could change the DNS list to something invalid and portmaster will fallback to the system-DNS which will be ProtonVPN in that case.
I am not sure though.

[FrostBlade5]

Yeah I've read that after I posted but I am sure that ProtonVPN = 0 privacy anyway. I wouldn't trust it. Especially free VPNs are the worst...

You could change the DNS list to something invalid and portmaster will fallback to the system-DNS which will be ProtonVPN in that case. I am not sure though.

I trust proton. They fight many legal cases every year, they seem to be a very open and transparent company and their support is very friendly and helpful, ofcourse free vpns are always suspicious, however protonvpn is not fully free as many users choose to buy a paid plan and thats how they make their money and perhaps some investors. As proton themselfes said: privacy over profit, they have the same rule as portmaster which is privacy first. You can never be 100% sure to trust any service, that goes for vpn aswell as portmaster. I will try your suggestion, haven't tought of that.

[davegson]

wrong thread, moved comment to where it belongs

[m77e4t]

If anyone figures out how to use ProtonVPN IP but with portmaster DNS, do update this thread.

So for example, can anyone do custom DNS configuration inside Portmaster via https://docs.safing.io/portmaster/guides/dns-configuration (for Quad9) but only for NL#104116? If proton has different DNS for every IP, the NL#69 IP will have a constant permanent DNS which we can change from portmaster.
Then we can only (and always) connect to NL#104116 with portmaster while other servers will be useless. They will be useless until we configure DNS for every Proton IP one by one.

I will try to do on my end, but someone should try on their end too. Eventually doing it for every single IP and exchanging it to every single Proton user via this backlog feature 'Crowd-Sourced App Settings' seen on https://safing.io/backlog/ will be pretty cool.

Also, this is not true #320 and should be changed as 'Issue Confirmed', as the very same thing appears on Safing docs https://docs.safing.io/portmaster/install/status/vpn-compatibility.

On another note, I can use ProtonVPN IP with a custom DNS (like nextdns) on android with the 'Private DNS' feature. It works for all Proton serves nicely. I would like to do the same thing with ProtonVPN + Portmaster....